1 Key Risks
The most critical security risks an operator inherits when deploying this agent in its documented default configuration. Synthflow presents a multi-channel voice and text input surface with autonomous action execution, minimal vendor-provided defenses, and no documented prompt injection detection on its default configuration.
2 AIRQ Scores
The four headline scores quantify how exposed the agent is, how damaging a successful attack would be, and how much the agent’s own controls reduce that risk. Synthflow's AIRQ composite reflects a platform where low blast radius from absent code execution partially offsets weak vendor-provided defenses and trifecta-elevated attack surface.
Synthflow lands in the Humble Providers quadrant with an attack surface of 4.80, blast radius of 2.50, and defense controls of 2 out of 15.
Each row reports one AIRQ axis: attack surface scored out of 10, blast radius out of 10, defense controls out of 15, and the composite AIRQ metric.
| Metric | Score | Comments |
|---|---|---|
| AIRQ Score | 1.63 | Low composite score driven by minimal blast radius and weak defenses on a platform with no code execution or deployment pipeline access. |
| Blast Radius | 2.5 / 10 | Network egress via custom HTTP actions and stored CRM credentials are the primary blast vectors; no code execution or deployment access documented. |
| Attack Surface | 4.8 / 10 | Multi-channel input and cross-session memory score moderate individually; the trifecta-complete condition floors the aggregate at the minimum threshold. |
| Defense Controls | 2 / 15 | No documented input guardrails, action controls, or output guardrails on the default configuration; monitoring provides basic logging without SIEM forwarding. |
3 Attack Surface
Attack surfaces are the entry points and interaction patterns through which adversarial input can reach the agent’s reasoning loop and steer its behavior. Synthflow's reasoning loop ingests untrusted content from six input channels and auto-injected memory summaries as first-class context on the default configuration.
Higher scores on user input and memory reflect multi-channel ingestion and unsanitized cross-session context injection documented in the vendor's platform.
Each row maps one attack surface component to its adjusted score and a comment describing the documented exposure on Synthflow's default configuration.
| Surface | Score | Comments |
|---|---|---|
| User Input | 3 / 4 | Accepts voice calls via SIP trunking [15], SMS, WhatsApp, web widget, API, and webhook input; PII redaction is documented but no prompt shield or injection classifier exists [1]. |
| External Data | 2 / 4 | Knowledge base ingests PDFs, URLs, website crawls, and Zendesk imports for RAG retrieval during calls without documented content sanitization [8]. |
| Memory | 3 / 4 | Cross-session Memory Groups build per-contact conversation summaries and replay them into subsequent calls with no integrity check or write gate [6]. |
| Reasoning | 2 / 4 | Vendor-managed OpenAI model handles reasoning with no documented prompt shielding or reasoning-chain controls beyond model defaults [9]. |
| Planning | 1 / 4 | Workflow sequencing is operator-configured at design time with no autonomous multi-step planning or dynamic goal decomposition documented [5]. |
| Tool Execution | 2 / 4 | Custom HTTP actions execute operator-configured requests during calls constrained to the specified endpoint, method, and authentication parameters [7]. |
| Orchestration | 2 / 4 | Workflows and call routing manage conversation flow; Aurora meta-agent assists with creation but does not orchestrate runtime multi-agent chains [5]. |
| Inter-Agent | 0 / 4 | Single-agent architecture with no documented inter-agent message passing, delegation, or shared context between independent agents [5]. |
| Output Processing | 2 / 4 | Outputs include voice responses, SMS, WhatsApp messages, and webhook payloads with no documented output sanitization or URL filtering [14]. |
| Configuration | 1 / 4 | API key authentication for platform access with agent configurations managed through the web console and no documented sub-workspace RBAC [17]. |
The Lethal Trifecta is triggered when an agent processes untrusted content, accesses private data, and communicates externally in the same session — the three conditions that turn an isolated prompt injection into full-chain exfiltration. Synthflow combines multi-channel voice and text input with CRM-stored customer data and outbound HTTP actions, triggering all three conditions on the default configuration.
Synthflow exhibits all three of these conditions in its documented default configuration:
- Untrusted input — Voice calls, SMS, WhatsApp messages, web widget input, and inbound webhooks inject attacker-controlled content into the reasoning loop [1][3].
- Sensitive data — CRM integrations store customer records and Memory Groups persist cross-session summaries containing caller-provided PII [6][13].
- External egress — Custom HTTP actions send requests to external endpoints and post-call webhooks transmit full transcripts to operator-configured URLs [7][14].
4 Blast Radius
The blast radius is what an attacker who controls the agent can reach — which systems they touch, which credentials they read, and which actions they take without operator approval. A compromised Synthflow agent reaches outbound HTTP endpoints via custom actions and stored CRM credentials but has no code execution, filesystem, or deployment access.
Higher blast scores on network, credentials, and autonomous action reflect outbound HTTP capability and stored integration tokens on the default configuration.
Each row ties a blast radius factor to its score and the documented capability or integration scope that determines the exposure level.
| Factor | Score | Comments |
|---|---|---|
| Code execution | 0 / 4 | No documented code execution, shell access, or browser automation capability available on the Synthflow platform [5]. |
| File system access | 0 / 4 | No filesystem read or write access; knowledge base documents are uploaded through the web console and not accessed from a runtime filesystem [8]. |
| Network access | 2 / 4 | Custom HTTP actions send outbound requests to operator-configured endpoints and post-call webhooks transmit data to external URLs [7][14]. |
| Credential access | 2 / 4 | CRM integration credentials, telephony API keys, and payment processor tokens are stored on the platform under the vendor's data handling practices [10][13][17]. |
| Autonomous action | 2 / 4 | Inbound call handling, outbound campaigns, SMS responses, and custom HTTP actions fire on configured triggers without per-action operator approval [16]. |
| Deployment access | 0 / 4 | No documented access to CI/CD pipelines, container registries, or infrastructure deployment systems from the Synthflow platform [5]. |
5 Defense Controls
Defense controls are what the agent’s own architecture does to detect, contain, and report attacks before they reach the operator’s systems. Synthflow publishes basic logging and claims compliance certifications but documents no input guardrails, action approval gates, or output redaction on the default configuration.
Higher defense scores indicate stronger vendor-provided safeguards; Synthflow's low scores reflect the absence of documented detection and enforcement layers.
Each component is scored based on vendor-documented controls present on the default configuration versus controls that require operator implementation.
| Component | Score | Comments |
|---|---|---|
| Input Guardrails | 0 / 3 | PII redaction is the only documented data-handling control; no dedicated prompt shield, input classifier, or content filtering layer exists on any channel [1][4]. |
| Execution Isolation | 1 / 3 | Cloud-hosted on GCP with SOC 2 and ISO 27001 claimed but no documented sandbox, container isolation, or tenant boundary architecture [11]. |
| Action Controls | 0 / 3 | No per-action approval gates, domain restrictions, or rate limiting documented for custom HTTP actions or outbound communications [7]. |
| Output Guardrails | 0 / 3 | No documented DLP, output redaction, URL sanitization, or structured output validation for voice responses, SMS, or webhook payloads [14]. |
| Monitoring | 1 / 3 | Platform logs cover call, chat, API, and webhook activity with export capability but no SIEM forwarding or behavioral anomaly detection [12]. |
6 Hardening Tips
Concrete actions an operator can take to reduce the risks reported above, grouped by which defense control each tip strengthens. Operators should prioritize deploying prompt injection detection on voice input, gating custom HTTP actions with approval workflows, and forwarding logs to a SIEM.
Input Guardrails
Input guardrails intercept adversarial content before it reaches the reasoning loop.
- Policy Require human review of all knowledge base documents before upload to prevent injection payloads from entering the RAG pipeline.
- Configuration Restrict inbound webhook sources to known IP ranges and require webhook signature verification on all incoming payloads.
- Engineering Deploy a prompt injection classifier covering the OWASP agentic AI risk categories [2] on voice transcription output before it enters the reasoning loop.
Execution Isolation
Execution isolation contains what a compromised agent can do on the host.
- Policy Request the vendor's tenant isolation architecture documentation and verify SOC 2 certification through a public registry.
- Configuration Restrict agent deployment to dedicated workspaces with separate API keys per environment to limit cross-environment exposure.
- Engineering Wrap Synthflow API calls in an infrastructure-layer network policy restricting outbound destinations to an approved allowlist.
Action Controls
Action controls govern which tools and actions the agent can invoke autonomously.
- Policy Establish a change-management process requiring approval before adding or modifying custom HTTP action endpoints in production agents.
- Configuration Limit custom HTTP actions to GET-only methods where write access is not operationally required and disable unused action types.
- Engineering Implement a proxy layer between Synthflow custom actions and downstream systems that validates payloads and enforces rate limits.
Output Guardrails
Output guardrails inspect what the agent sends to other systems and users.
- Policy Prohibit transmitting unredacted PII in post-call webhook payloads and require data classification before configuring webhook destinations.
- Configuration Enable PII redaction for all call recordings and transcripts and restrict webhook payload fields to the minimum required.
- Engineering Integrate a DLP scanning layer on webhook output streams to detect and redact credentials and PII before transmission.
Monitoring
Monitoring captures what the agent did and surfaces anomalies for review.
- Policy Establish a weekly review cadence for call and webhook logs focusing on anomalous custom action invocations.
- Configuration Export call logs to an organizational SIEM via scheduled API pulls to enable correlation with other security signals.
- Engineering Build automated alerting on custom action failure rates, unusual outbound request volumes, and after-hours call activity patterns.
7 References
The evidence base behind every score and finding in the profile, grouped by source type so the reader can verify any claim. Numbers in brackets throughout the report (e.g. [7, 13]) refer to entries below, listed in citation order.
Selected Vulnerabilities
- Synthflow Security and Compliance Vendor security documentation describing agent-level data retention controls and PII redaction capabilities with no runtime input guardrails on the default configuration.
Selected Research
- OWASP Top 10 for Agentic AI Applications OWASP GenAI Security Project release covering agent behavior hijacking, tool misuse, and identity abuse risks applicable to conversational AI agents.
- Policy-First Strategy for Securing Agentic Voice AI Security analysis of voice prompt injection risks in agentic voice systems where spoken instructions bypass safety policies and trigger tool actions.
- Indirect Prompt Injection Defense for AI Agents Technical analysis of indirect prompt injection defenses covering OWASP LLM01 and EU AI Act Article 15 cybersecurity obligations for production agents.
Vendor Documentation
- Synthflow Platform Documentation Primary documentation hub for the Synthflow voice AI platform covering agent lifecycle, API reference, integrations, and configuration options.
- Memory of Past Calls Vendor documentation describing cross-session Memory Groups that auto-generate conversation summaries per contact and inject them into future calls without integrity verification.
- Custom Actions Vendor documentation describing HTTP request capabilities during calls with operator-configured method, endpoint, headers, body, and authentication parameters.
- Knowledge Base Vendor documentation describing RAG retrieval from uploaded PDFs, URLs, website crawls, and Zendesk imports attached to agents for call-time queries.
- AI Transparency Statement EU AI Act disclosure listing subprocessors including GCP, OpenAI, Deepgram, ElevenLabs, Bubble.io, and Twilio alongside data handling practices.
- Synthflow Privacy Policy Privacy policy describing GDPR and BDSG compliance, data processing practices, and security measures for the platform.
- HIPAA Compliant AI Agents Vendor blog asserting SOC 2, HIPAA, PCI DSS Level 1, ISO 27001, and GDPR certifications with end-to-end encryption and RBAC across the platform.
- Synthflow Logs Vendor documentation describing centralized logging for calls, chats, API requests, and webhooks with export capabilities but no SIEM integration or anomaly detection.
- Integrations Overview Vendor documentation listing CRM, telephony, scheduling, payments, and automation platform connections available for Synthflow agents.
- Post-Call Webhook Vendor documentation describing post-call webhook payloads transmitted to external URLs including full transcripts and extracted data.
- Telephony Overview Vendor documentation describing Synthflow-owned SBCs, in-house telephony infrastructure, and carrier integrations via SIP trunking.
Other Sources
- Actions Overview Overview of all Synthflow action types including call transfers, custom HTTP actions, in-call messaging, real-time booking, SMS, information extractors, and IVR handling.
- Synthflow API Authentication API authentication documentation describing Bearer token authentication and key management practices for the Synthflow platform.